GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49553 (GCVE-0-2022-49553)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:14 – Updated: 2026-08-05 08:55
VLAI
Title
fs/ntfs3: validate BOOT sectors_per_clusters
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate BOOT sectors_per_clusters When the NTFS BOOT sectors_per_clusters field is > 0x80, it represents a shift value. Make sure that the shift value is not too large before using it (NTFS max cluster size is 2MB). Return -EVINVAL if it too large. This prevents negative shift values and shift values that are larger than the field size. Prevents this UBSAN error: UBSAN: shift-out-of-bounds in ../fs/ntfs3/super.c:673:16 shift exponent -192 is negative
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < 58cf68a1886d14ffdc5c892ce483a82156769e88 (git)
Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < 4746c49b11b2403f5b5b07c6eac9e60663dcd9a3 (git)
Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < a2b6986316a2d106f6951e76db70fa4b2fde64a9 (git)
Affected: 82cae269cfa953032fbb8980a7d554d60fb00b17 , < a3b774342fa752a5290c0de36375289dfcf4a260 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.45 , ≤ 5.15.* (semver)
Unaffected: 5.17.13 , ≤ 5.17.* (semver)
Unaffected: 5.18.2 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "58cf68a1886d14ffdc5c892ce483a82156769e88",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "4746c49b11b2403f5b5b07c6eac9e60663dcd9a3",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "a2b6986316a2d106f6951e76db70fa4b2fde64a9",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "a3b774342fa752a5290c0de36375289dfcf4a260",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.45",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.13",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate BOOT sectors_per_clusters\n\nWhen the NTFS BOOT sectors_per_clusters field is \u003e 0x80, it represents a\nshift value.  Make sure that the shift value is not too large before using\nit (NTFS max cluster size is 2MB).  Return -EVINVAL if it too large.\n\nThis prevents negative shift values and shift values that are larger than\nthe field size.\n\nPrevents this UBSAN error:\n\n UBSAN: shift-out-of-bounds in ../fs/ntfs3/super.c:673:16\n shift exponent -192 is negative"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only by mounting a crafted NTFS block device/image so ntfs_init_from_boot reads attacker-controlled BOOT.sectors_per_clusters; there is no network or adjacent-protocol entry into fs/ntfs3.\nAC:L - A malicious BOOT with sectors_per_clusters in 0x81\u20130xF3 deterministically triggers the out-of-bounds shift in true_sectors_per_clst(); the attacker fully controls that field with no race or special memory layout required.\nPR:N - The attacker needs no account on the target\u2014only a malicious NTFS image (USB stick, disk/container image, or media presented to udisks2/automount), matching the established hostile-image scoring for this ntfs3 class.\nUI:R - ntfs3 is FS_REQUIRES_DEV without FS_USERNS_MOUNT, so a victim or automount daemon must mount the attacker-supplied volume before the vulnerable boot-sector parse runs.\nS:U - Impact is confined to the host kernel\u2019s handling of the mounted volume under the same OS security authority; it is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - The undefined shift yields attacker-influenced sectors_per_cluster/cluster_size geometry that can pass mount checks and drive subsequent NTFS parsing; wrong cluster geometry enables out-of-bounds reads of kernel/on-disk structures, so Confidentiality is High.\nI:H - The same poisoned cluster_size/cluster_bits feed allocation, MFT, and runlist paths that perform size-based copies and updates, enabling heap/metadata corruption and control-flow hijack primitives; Integrity is High.\nA:H - The demonstrated UBSAN shift-out-of-bounds in ntfs_fill_super and subsequent operations on invalid cluster geometry can oops/panic the kernel, so Availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:39.688Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/58cf68a1886d14ffdc5c892ce483a82156769e88"
        },
        {
          "url": "https://git.kernel.org/stable/c/4746c49b11b2403f5b5b07c6eac9e60663dcd9a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2b6986316a2d106f6951e76db70fa4b2fde64a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3b774342fa752a5290c0de36375289dfcf4a260"
        }
      ],
      "title": "fs/ntfs3: validate BOOT sectors_per_clusters",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49553",
    "datePublished": "2025-02-26T02:14:02.183Z",
    "dateReserved": "2025-02-26T02:08:31.590Z",
    "dateUpdated": "2026-08-05T08:55:39.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49553",
      "date": "2026-09-18",
      "epss": "0.00275",
      "percentile": "0.20176"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/super.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "58cf68a1886d14ffdc5c892ce483a82156769e88",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4746c49b11b2403f5b5b07c6eac9e60663dcd9a3",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a2b6986316a2d106f6951e76db70fa4b2fde64a9",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a3b774342fa752a5290c0de36375289dfcf4a260",
                    "status": "affected",
                    "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/super.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.45",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.17.*",
                    "status": "unaffected",
                    "version": "5.17.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.18.*",
                    "status": "unaffected",
                    "version": "5.18.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3DD87F23-E492-46AA-B833-5E41761636B4",
                    "versionEndExcluding": "5.15.45",
                    "versionStartIncluding": "5.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "192FC54B-5367-49D6-B410-0285F14665B1",
                    "versionEndExcluding": "5.17.13",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9FF255A1-64F4-4E31-AF44-C92FB8773BA2",
                    "versionEndExcluding": "5.18.2",
                    "versionStartIncluding": "5.18",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate BOOT sectors_per_clusters\n\nWhen the NTFS BOOT sectors_per_clusters field is \u003e 0x80, it represents a\nshift value.  Make sure that the shift value is not too large before using\nit (NTFS max cluster size is 2MB).  Return -EVINVAL if it too large.\n\nThis prevents negative shift values and shift values that are larger than\nthe field size.\n\nPrevents this UBSAN error:\n\n UBSAN: shift-out-of-bounds in ../fs/ntfs3/super.c:673:16\n shift exponent -192 is negative"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/ntfs3: validar sectores_por_cl\u00fasteres de BOOT Cuando el campo sectores_por_cl\u00fasteres de BOOT de NTFS es \u0026gt; 0x80, representa un valor de desplazamiento. Aseg\u00farese de que el valor de desplazamiento no sea demasiado grande antes de usarlo (el tama\u00f1o m\u00e1ximo del cl\u00faster de NTFS es 2 MB). Devuelva -EVINVAL si es demasiado grande. Esto evita valores de desplazamiento negativos y valores de desplazamiento que sean m\u00e1s grandes que el tama\u00f1o del campo. Previene este error de UBSAN: UBSAN: desplazamiento fuera de los l\u00edmites en ../fs/ntfs3/super.c:673:16 el exponente de desplazamiento -192 es negativo"
          }
        ],
        "id": "CVE-2022-49553",
        "lastModified": "2026-08-04T10:17:51.030",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-02-26T07:01:31.133",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4746c49b11b2403f5b5b07c6eac9e60663dcd9a3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/58cf68a1886d14ffdc5c892ce483a82156769e88"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a2b6986316a2d106f6951e76db70fa4b2fde64a9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a3b774342fa752a5290c0de36375289dfcf4a260"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-190"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:38:58+00:00",
      "cve": "CVE-2022-49553",
      "id": "CVE-2022-49553",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs/ntfs3: validate BOOT sectors_per_clusters",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49553.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.